The George Sexton WordPress Events Calendar Plugin – connectDaily (versions up to 1.5.4) contains a CSRF vulnerability that enables Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to trick authenticated users into executing unwanted actions, potentially compromising the confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score of 7.1 reflects a high severity with network attack vector and low complexity, requiring user interaction but no privileges. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow attackers to execute unauthorized actions via CSRF, which may lead to Cross-Site Scripting (XSS). This can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress plugin environment. The vulnerability affects all users of the plugin up to version 1.5.4. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or implementing CSRF protections at the application or web server level. Monitor official sources for updates and apply patches promptly once available.